---
title: "Security digest: December 9, 2025"
url: https://erroneo.us/security/2025-12-09/
description: "December 9, 2025 vulnerability digest: 1 brief (FortiCloud SSO SAML Bypass: CVE-2025-59718/59719); 2 CISA KEV additions (Microsoft, RARLAB); 6 critical…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-12-09
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: December 9, 2025

1 editorial brief, 2 known exploited (cisa kev) additions and 6 critical advisories.

## Take stock

- Act now: FortiCloud SSO SAML Bypass: CVE-2025-59718/59719 . Owners of FortiGate (FortiOS 7.0-7.6), FortiProxy, FortiWeb 7.4-8.0 or FortiSwitchManager devices that were registered to FortiCare from the GUI without turning off FortiCloud SSO login.
- Do you run any of these? Microsoft Windows, RARLAB WinRAR. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-12-30.
- Maven: 2 critical advisories ( net.sf.robocode:robocode.core , net.sf.robocode:robocode.battle ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 2 critical advisories ( neuron-core/neuron-ai , onelogin/php-saml ). Check with composer audit .
- npm: 1 critical advisory ( elysia ). Check with npm audit (or: npm ls <package>) .
- PyPI: 1 critical advisory ( cai-framework ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [FortiCloud SSO SAML Bypass: CVE-2025-59718/59719](https://erroneo.us/security/briefs/forticloud-sso-saml-bypass-cve-2025-59718/index.md): If any Fortinet device has FortiCloud SSO admin login turned on, it was open to unauthenticated admin takeover; upgrade, then also apply the January 2026 fix for CVE-2026-24858, which bypassed this patch.

## Known exploited (CISA KEV)

- [CVE-2025-62221](https://erroneo.us/security/cve/CVE-2025-62221/index.md) Microsoft Windows: Microsoft Windows Use After Free Vulnerability (CISA due 2025-12-30)
- [CVE-2025-6218](https://erroneo.us/security/cve/CVE-2025-6218/index.md) RARLAB WinRAR: RARLAB WinRAR Path Traversal Vulnerability (CISA due 2025-12-30)

## Critical advisories

- [CVE-2025-14306](https://erroneo.us/security/cve/CVE-2025-14306/index.md) Robocode vulnerable to Directory Traversal in recursivelyDelete Method — Maven net.sf.robocode:robocode.core < 1.9.5.6 → 1.9.5.6
- [CVE-2025-66456](https://erroneo.us/security/cve/CVE-2025-66456/index.md) Elysia vulnerable to prototype pollution with multiple standalone schema validation — npm elysia >= 1.4.0, < 1.4.17 → 1.4.17
- [CVE-2025-67510](https://erroneo.us/security/cve/CVE-2025-67510/index.md) Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) — Composer (PHP) neuron-core/neuron-ai <= 2.8.11 → 2.8.12
- [GHSA-5j8p-438x-rgg5](https://erroneo.us/security/ghsa/GHSA-5j8p-438x-rgg5/index.md) SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475 — Composer (PHP) onelogin/php-saml < 2.21.1 → 2.21.1; Composer (PHP) onelogin/php-saml >= 3.0.0, < 3.8.1 → 3.8.1; Composer (PHP) onelogin/php-saml >= 4.0.0, < 4.3.1 → 4.3.1
- [CVE-2025-67511](https://erroneo.us/security/cve/CVE-2025-67511/index.md) Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool — PyPI cai-framework <= 0.5.9 → no fix
- [CVE-2025-14307](https://erroneo.us/security/cve/CVE-2025-14307/index.md) Robocode has an insecure temporary file creation vulnerability in the AutoExtract component — Maven net.sf.robocode:robocode.battle < 1.9.5.6 → 1.9.5.6

---
Source page: https://erroneo.us/security/2025-12-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt